Multi-tenant SaaS with two isolation tiers, designed for HIPAA and SOC 2

Businesses re-key sensitive customer data into long official PDF forms. The data needs encryption and audit from day one, many tenants share one system, and larger customers expect infrastructure of their own.

All engineering over 14 months, including the deployment on Azure with Terraform.

• Architecture: Two isolation tiers: standard tenants share one PostgreSQL database behind row-level security; enterprise tenants get their own database, and each request is routed to the right one.
• Security: Per-tenant encryption keys, MFA with TOTP and WebAuthn, role-based access, audit logging, 15-minute idle sign-out and a nonce-based CSP. Designed for HIPAA and SOC 2 compliance.
• Infrastructure & DevOps: About 50 Azure resources in Terraform: a hub-and-spoke network, private endpoints, a web application firewall and automated certificates; keyless CI/CD sign-in.
• Frontend: A guided interview from a one-time link, and a role-gated dashboard for each tenant's team.
• Backend & AI: Celery workers fill each form in memory; two models map new forms from public material, with a deterministic check.
• Testing: 12,900+ tests across backend, frontend and end-to-end, plus mutation testing.

• Shared database or one per tenant? Both. Row-level security keeps standard tenants cheap to run in one database; enterprise tenants get their own spoke network, connected to the shared hub, and their own database server. Tenant rows carry a tenant id instead of a link to a central table, so they can move later.
• A missing policy leaks silently. Row-level security is opt-in per table, so one table without a policy would expose every tenant's rows. A test, a live-database audit and a table ledger catch it.
• Compliance from the first commit. HIPAA and SOC 2 controls (keys, MFA, roles, audit log, session limits) were built in before any customer data existed and are tracked against a checklist, not added before an audit.

The isolation, encryption and access model is in place and under test: the database keeps standard tenants apart, enterprise routing is built, and automatic enterprise provisioning is designed and next.